[Feature] Establish function-bound Postbox domain, capabilities, and access decisions #21

New Issue

2026-07-28T23:01:06+02:00

zemion commented

2026-07-28 23:01:06 +02:00

Outcome

Implement the first usable Postbox backend: module manifest, versioned capability contracts, Postbox-owned persistence, stable function/unit addresses, lazy materialization, current function-assignment access decisions, vacancy state, message delivery/list/read/acknowledgement, and auditable provenance.

Acceptance criteria

Postbox owns templates/revisions, addresses, containers, bindings, messages, participants, attachment references, deliveries, grouping state, receipts, and access events.
Function-bound access consumes Identity, IDM, Organizations, and generic Core/Access permissions through capabilities without importing their ORM models.
Direct, delegated, and explicit acting contexts are distinguishable; acting-in-place access requires the selected assignment context.
Stable addresses resolve idempotently and remain usable while vacant.
Delivery accepts idempotency keys and preserves typed producer/evidence references.
The schema reserves ciphertext manifest, key epoch, expiry, and withdrawal state without claiming E2EE before a trusted profile is selected.
Focused backend, migration, access, and capability tests pass.

## Outcome Implement the first usable Postbox backend: module manifest, versioned capability contracts, Postbox-owned persistence, stable function/unit addresses, lazy materialization, current function-assignment access decisions, vacancy state, message delivery/list/read/acknowledgement, and auditable provenance. ## Acceptance criteria - Postbox owns templates/revisions, addresses, containers, bindings, messages, participants, attachment references, deliveries, grouping state, receipts, and access events. - Function-bound access consumes Identity, IDM, Organizations, and generic Core/Access permissions through capabilities without importing their ORM models. - Direct, delegated, and explicit acting contexts are distinguishable; acting-in-place access requires the selected assignment context. - Stable addresses resolve idempotently and remain usable while vacant. - Delivery accepts idempotency keys and preserves typed producer/evidence references. - The schema reserves ciphertext manifest, key epoch, expiry, and withdrawal state without claiming E2EE before a trusted profile is selected. - Focused backend, migration, access, and capability tests pass.

zemion added the module/postbox area/api codex/ready area/governance area/security

labels 2026-07-28 23:01:06 +02:00

zemion commented

2026-07-29 00:19:20 +02:00

Codex State: progress

The first usable Postbox foundation described here is implemented across govoplan-postbox, Core contracts, IDM reverse/batch assignment resolution, and the meta composition. The baseline migration applied successfully to PostgreSQL. Verification: 9 Postbox tests, 115 Core contract/module tests, IDM tests, Postbox UI checks, full focused checks, and composed production WebUI build. Changes are local and await a coordinated commit/release before this issue is closed.

## Codex State: progress The first usable Postbox foundation described here is implemented across `govoplan-postbox`, Core contracts, IDM reverse/batch assignment resolution, and the meta composition. The baseline migration applied successfully to PostgreSQL. Verification: 9 Postbox tests, 115 Core contract/module tests, IDM tests, Postbox UI checks, full focused checks, and composed production WebUI build. Changes are local and await a coordinated commit/release before this issue is closed.

zemion commented

2026-07-29 13:26:00 +02:00

Codex State: progress

_access_decision remains D/22 in the fresh complexity report. Because this is an authorization-sensitive path, extract a declarative decision table for direct assignment, function/unit hierarchy, bounded upward copies, vacancy/escalation, and denial provenance. Add exhaustive allow/deny/reason tests and keep the evaluator independent of Campaign/Mail implementations.

## Codex State: progress `_access_decision` remains D/22 in the fresh complexity report. Because this is an authorization-sensitive path, extract a declarative decision table for direct assignment, function/unit hierarchy, bounded upward copies, vacancy/escalation, and denial provenance. Add exhaustive allow/deny/reason tests and keep the evaluator independent of Campaign/Mail implementations.

zemion commented

2026-07-30 14:32:59 +02:00

Completed in bdc161e. Access evaluation is centralized in an explicit decision table with focused coverage for function membership, hierarchy, vacancy, withdrawal, expiry, and tenant boundaries. Postbox suite: 24 tests passed.

Completed in `bdc161e`. Access evaluation is centralized in an explicit decision table with focused coverage for function membership, hierarchy, vacancy, withdrawal, expiry, and tenant boundaries. Postbox suite: 24 tests passed.

zemion closed this issue

2026-07-30 14:32:59 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-postbox#21